CVE-2026-54157: LobeHub SSRF and cookie injection in webapi proxy

CVE-2026-54157 · Severity: critical · CVSS 9 · Published 2026-06-23

LobeHub, an AI agent collaboration platform, contained a security flaw in its web proxy component. An attacker could use this flaw to make the LobeHub servers send unauthorized requests to other websites or internal systems. This could lead to the exposure of internal infrastructure details or the injection of malicious cookies into a user's browser, potentially allowing an attacker to hijack user sessions.

Technologies: LobeHub Lobe Chat, @lobehub/lobehub (npm). Vendors: LobeHub, npm.

Quick answers

Is CVE-2026-54157 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54157 being exploited in the wild.
How severe is CVE-2026-54157?
Critical severity, with a CVSS score of 9, published 23 June 2026.
Which products and versions are affected?
LobeHub Lobe Chat < 2.1.57; @lobehub/lobehub (npm) <= 2.1.56, SEMVER:introduced=0,fixed=2.1.57.
Is there a fix for CVE-2026-54157?
Yes. @lobehub/lobehub (npm): upgrade to 2.1.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54157 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54157?
Check whether you run LobeHub Lobe Chat or @lobehub/lobehub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @lobehub/lobehub (npm): upgrade to 2.1.57 or later
    npm install @lobehub/lobehub@2.1.57

Technical details

An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in LobeHub's `/webapi/proxy` endpoint. The root cause is a missing `checkAuth()` wrapper in the route handler located at `src/app/(backend)/webapi/proxy/route.ts`, which allows the endpoint to accept and fetch any URL provided in a POST body without authentication. Beyond standard SSRF, the proxy reflects upstream `Set-Cookie` headers, enabling attackers to perform cookie injection on the `lobehub.com` domain. This can be leveraged for session fixation attacks against Clerk-managed sessions or to leak Vercel deployment metadata (e.g., `X-Vercel-Id` headers). The vulnerability is resolved in version 2.1.57 by implementing proper authentication checks.

Affected products

  • LobeHub LobeHub < 2.1.57

Identifiers

  • CVE-2026-54157
  • GHSA-xmwj-c75x-6346

Timeline

  • 2026-06-03: advisory: Initial GitHub security advisory published
  • 2026-06-23: disclosed: CVE-2026-54157 published to NVD
  • 2026-06-23: patched: Fix released in version 2.1.57

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.